Solved: Add a submit button -fetch result only if submit i...

nithys · ‎10-07-2024

Hi I have a drop down based on domain ,entity so when i select domain , entity and date selected it fetch result of initlambda,init duplicate,init error...I want to have a extra submit button ,once i hit submit then only run the result for initlambda,init duplicate,init error otherwise dont fetch anything

<row>
<panel>
<title> VIEW BY ENTITY</title>
<input type="dropdown" token="tokEnvironment" searchWhenChanged="true">
<label>Domain</label>
<choice value="Costing">Costing</choice>
<change>
<set token="inputToken">""</set>
<set token="outputToken">""</set>
<set token="inputToken2">""</set>
<set token="outputToken2">""</set>
<unset token="tokSystem"></unset>
<unset token="form.tokSystem"></unset>
</change>
<default>Cost</default>
<initialValue>Cost</initialValue>
</input>
<input type="dropdown" token="tokSystem" searchWhenChanged="false">
<label>Data Entity</label>
<fieldForLabel>$tokEnvironment$</fieldForLabel>
<fieldForValue>$tokEnvironment$</fieldForValue>
<search>










<query>| makeresults
| fields - _time
| eval Costing="GetQuoteByCBD,bolHeader,bolLineItems,laborProcess,costSheetCalc,FOB"
| fields $tokEnvironment$
| makemv $tokEnvironment$ delim=","
| mvexpand $tokEnvironment$</query>
</search>
<change>
<condition match="$label$=="get"">
<set token="inputToken">get</set>
<set token="outputToken">get</set>
<set token="inputToken2">b</set>
<set token="outputToken2">b</set>
<set token="inputToken3">c</set>
<set token="outputToken3">c</set>
<set token="inputToken4">d</set>
<set token="outputToken4">d</set>
<set token="inputToken5">e</set>
<set token="outputToken5">e</set>
<set token="inputToken4">d</set>
<set token="outputToken4">d</set>
<set token="inputToken3">3</set>
<set token="outputToken3">3</set>
<set token="apiToken">d</set>
<set token="entityToken">get</set>
</condition>
<condition match="$label$=="batch"">
<set token="inputToken">batch</set>
<set token="outputToken">batch</set>
<set token="inputToken2">c</set>
<set token="outputToken2">c</set>
<set token="inputToken">b</set>
<set token="outputToken4">b</set>
<set token="inputToken3">d</set>
<set token="outputToken3">d</set>
<set token="apiToken">b</set>
<set token="inputToken5">f</set>
<set token="outputToken5">f</set>
<set token="entityToken">batch</set>
</condition>
</condition>
<condition match="$label$=="Calc"">
<set token="inputToken">Calc</set>
<set token="outputToken">Calc</set>
<set token="inputToken2">init</set>
<set token="outputToken2">init</set>
<set token="inputToken">Calc</set>
<set token="outputToken4">Calc</set>
<set token="inputToken3">d</set>
<set token="outputToken3">d</set>
<set token="apiToken">Calc</set>
<set token="entityToken">Calc</set>

</condition>

</change>
<default>get</default>
</input>
<input type="time" token="time_picker" searchWhenChanged="true">
<label>Time</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
<html>
<u1> </u1>
</html>
</panel>
</row>
<row>
<panel>
<title>Init Lambda</title>
<table>
<search>
<query>index="" source IN ("/aws/lambda/aa-$outputToken$-$stageToken$-$outputToken2$") | spath msg | search msg="gemini:streaming:info:*" | stats count by msg</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>Init Lambda - Duplicate</title>
<table>
<search>
<query>index="" source IN ("/aws/lambda/aa-$outputToken$-$stageToken$-$outputToken2$") | spath msg | search msg="gemini:streaming:warning:*" | stats count by msg</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>Init Lambda - Error</title>
<table>
<search>
<query>index=""source IN ("/aws/lambda/aa-$outputToken$-$stageToken$-$outputToken2$") | spath msg | search msg="gemini:streaming:error:*" | stats count by msg</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>

dural_yyz · ‎10-11-2024

<input type="dropdown" token="tokEnvironment" searchWhenChanged="true">

This is the problem, this triggers the search when this token changes, you have it in time as well.

Here is a sample board I've created with multiple panels and different searches. It will only trigger on submit button press.

<form version="1.1" theme="dark">
  <label>Answers - Classic</label>
  <fieldset submitButton="true">
    <input type="dropdown" token="tok_idx">
      <label>Indexes</label>
      <fieldForLabel>index</fieldForLabel>
      <fieldForValue>index</fieldForValue>
      <search>
        <query>| tstats count where index=_* by index</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="time" token="tok_time" searchWhenChanged="false">
      <label>Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$tok_idx$ :: $tok_time$</title>
      <chart>
        <title>Total Events</title>
        <search>
          <query>| tstats count where index=$tok_idx$ by _time span=1h</query>
          <earliest>$tok_time.earliest$</earliest>
          <latest>$tok_time.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel>
      <title>$tok_idx$ :: $tok_time$</title>
      <chart>
        <title>Total Events by Sourcetype</title>
        <search>
          <query>| tstats count where index=$tok_idx$ by _time sourcetype span=1h
| timechart sum(count) by sourcetype</query>
          <earliest>$tok_time.earliest$</earliest>
          <latest>$tok_time.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</form>

View solution in original post

nithys · ‎10-07-2024

<row>
<panel>
<title> VIEW BY ENTITY</title>
<input type="dropdown" token="tokEnvironment" searchWhenChanged="true">
<label>Domain</label>
<choice value="Costing">Costing</choice>
<change>
<set token="inputToken">""</set>
<set token="outputToken">""</set>
<set token="inputToken2">""</set>
<set token="outputToken2">""</set>
<unset token="tokSystem"></unset>
<unset token="form.tokSystem"></unset>
</change>
<default>Cost</default>
<initialValue>Cost</initialValue>
</input>
<input type="dropdown" token="tokSystem" searchWhenChanged="false">
<label>Data Entity</label>
<fieldForLabel>$tokEnvironment$</fieldForLabel>
<fieldForValue>$tokEnvironment$</fieldForValue>
<search>
<!--<progress>-->
<!-- match attribute for condition uses eval-like expression (see Splunk search language 'eval' command) -->
<!-- logic: if resultCount is 0, then show a static html element, and hide the chart element -->
<!-- <condition match="'job.resultCount'== 0">-->
<!-- <set token="show_html">true</set>-->
<!-- </condition>-->
<!-- <condition>-->
<!-- <unset token="show_html"/>-->
<!-- </condition>-->
<!-- </progress>-->
<query>| makeresults
| fields - _time
| eval Costing="GetQuoteByCBD,bolHeader,bolLineItems,laborProcess,costSheetCalc,FOB"
| fields $tokEnvironment$
| makemv $tokEnvironment$ delim=","
| mvexpand $tokEnvironment$</query>
</search>
<change>
<condition match="$label$==&quot;get&quot;">
<set token="inputToken">get</set>
<set token="outputToken">get</set>
<set token="inputToken2">b</set>
<set token="outputToken2">b</set>
<set token="inputToken3">c</set>
<set token="outputToken3">c</set>
<set token="inputToken4">d</set>
<set token="outputToken4">d</set>
<set token="inputToken5">e</set>
<set token="outputToken5">e</set>
<set token="inputToken4">d</set>
<set token="outputToken4">d</set>
<set token="inputToken3">3</set>
<set token="outputToken3">3</set>
<set token="apiToken">d</set>
<set token="entityToken">get</set>
</condition>
<condition match="$label$==&quot;batch&quot;">
<set token="inputToken">batch</set>
<set token="outputToken">batch</set>
<set token="inputToken2">c</set>
<set token="outputToken2">c</set>
<set token="inputToken">b</set>
<set token="outputToken4">b</set>
<set token="inputToken3">d</set>
<set token="outputToken3">d</set>
<set token="apiToken">b</set>
<set token="inputToken5">f</set>
<set token="outputToken5">f</set>
<set token="entityToken">batch</set>
</condition>
</condition>
<condition match="$label$==&quot;Calc&quot;">
<set token="inputToken">Calc</set>
<set token="outputToken">Calc</set>
<set token="inputToken2">init</set>
<set token="outputToken2">init</set>
<set token="inputToken">Calc</set>
<set token="outputToken4">Calc</set>
<set token="inputToken3">d</set>
<set token="outputToken3">d</set>
<set token="apiToken">Calc</set>
<set token="entityToken">Calc</set>

</condition>

</change>
<default>get</default>
</input>
<input type="time" token="time_picker" searchWhenChanged="true">
<label>Time</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
<html>
<u1> </u1>
</html>
</panel>
</row>
<row>
<panel>
<title>Init Lambda</title>
<table>
<search>
<query>index="" source IN ("/aws/lambda/aa-$outputToken$-$stageToken$-$outputToken2$") | spath msg | search msg="gemini:streaming:info:*" | stats count by msg</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>Init Lambda - Duplicate</title>
<table>
<search>
<query>index="" source IN ("/aws/lambda/aa-$outputToken$-$stageToken$-$outputToken2$") | spath msg | search msg="gemini:streaming:warning:*" | stats count by msg</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>Init Lambda - Error</title>
<table>
<search>
<query>index=""source IN ("/aws/lambda/aa-$outputToken$-$stageToken$-$outputToken2$") | spath msg | search msg="gemini:streaming:error:*" | stats count by msg</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>

dural_yyz · ‎10-11-2024

<input type="dropdown" token="tokEnvironment" searchWhenChanged="true">

This is the problem, this triggers the search when this token changes, you have it in time as well.

Here is a sample board I've created with multiple panels and different searches. It will only trigger on submit button press.

<form version="1.1" theme="dark">
  <label>Answers - Classic</label>
  <fieldset submitButton="true">
    <input type="dropdown" token="tok_idx">
      <label>Indexes</label>
      <fieldForLabel>index</fieldForLabel>
      <fieldForValue>index</fieldForValue>
      <search>
        <query>| tstats count where index=_* by index</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="time" token="tok_time" searchWhenChanged="false">
      <label>Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$tok_idx$ :: $tok_time$</title>
      <chart>
        <title>Total Events</title>
        <search>
          <query>| tstats count where index=$tok_idx$ by _time span=1h</query>
          <earliest>$tok_time.earliest$</earliest>
          <latest>$tok_time.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel>
      <title>$tok_idx$ :: $tok_time$</title>
      <chart>
        <title>Total Events by Sourcetype</title>
        <search>
          <query>| tstats count where index=$tok_idx$ by _time sourcetype span=1h
| timechart sum(count) by sourcetype</query>
          <earliest>$tok_time.earliest$</earliest>
          <latest>$tok_time.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</form>

nithys · ‎10-22-2024

Thanks for the solution which worked When i select the data entity and the time and hit the submit button ...But without selecting the env test or prod the query get search based on the default dropdown applies to the query if it is test index as "np-ap" and sets stageToken as test.

I want the submit button to work even for the env selection ...along with data entity and date

index="np-ap" AND source="--a-test"
<query>index=$indexToken$ AND source="-a-$stageToken$"

<form version="1.1" theme="dark">
<label> stats</label>
<fieldset submitButton="true">
<input type="dropdown" token="indexToken1">
<label>Environment</label>
<choice value="pd-ap,prod">PROD</choice>
<choice value="np-ap,test">TEST</choice>
<change>
<eval token="stageToken">mvindex(split($value$,","),1)</eval>
<eval token="indexToken">mvindex(split($value$,","),0)</eval>
</change>
<default>np-ap,test</default>
</input>
<input type="dropdown" token="entityToken">
<label>Data Entity</label>
<choice value="aa">aa</choice>
<choice value="bb">bb</choice>
<choice value="cc">cc</choice>
<choice value="dd">dd</choice>
<choice value="ee">ee</choice>
<choice value="ff">ff</choice>
<default>aa</default>
</input>
<input type="time" token="timeToken" searchWhenChanged="false">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<html id="APIStats">
<style>
#user{
text-align:center;
color:#BFFF00;
}
</style>
<h2 id="user">API</h2>
</html>
</panel>
</row>
<row>
<panel>
<table>
<title>Unique</title>
<search>
<query>index=$indexToken$ AND source="-a-$stageToken$" 

| stats count </query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>

</row>

</form>

dural_yyz · ‎10-23-2024

When you force a default it will populate the token, as long as the token is populated then the search will return results. I would remove the default but I feel like you set that for a reason. So maybe I'm not understanding the full use case.

nithys · ‎10-24-2024

Currently without hitting the submit button,when i load the dashboard it get result of the below usage statistics of the selected test environment

Query used first checks if env is selected "test" then use "index" as "np-ap" and set "stageToken" as "test"

I want the submit button to work and get the result only after the env ,data entity and date is selected and hit the submit button

index="np-ap" AND source="--a-test"
<query>index=$indexToken$ AND source="-a-$stageToken$"

<form version="1.1" theme="dark">
<label> stats</label>
<fieldset submitButton="true">
<input type="dropdown" token="indexToken1">
<label>Environment</label>
<choice value="pd-ap,prod">PROD</choice>
<choice value="np-ap,test">TEST</choice>
<change>
<eval token="stageToken">mvindex(split($value$,","),1)</eval>
<eval token="indexToken">mvindex(split($value$,","),0)</eval>
</change>

</input>
<input type="dropdown" token="entityToken">
<label>Data Entity</label>
<choice value="aa">aa</choice>
<choice value="bb">bb</choice>
<choice value="cc">cc</choice>
<choice value="dd">dd</choice>
<choice value="ee">ee</choice>
<choice value="ff">ff</choice>
<default>aa</default>
</input>
<input type="time" token="timeToken" searchWhenChanged="false">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<html id="APIStats">
<style>
#user{
text-align:center;
color:#BFFF00;
}
</style>
<h2 id="user">API</h2>
</html>
</panel>
</row>
<row>
<panel>
<table>
<title>Unique</title>
<search>
<query>index=$indexToken$ AND source="-a-$stageToken$" 

| stats count </query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>

</row>

</form>

dural_yyz · ‎10-11-2024

Oh and I put the tokens in my panel titles only as a sanity debug check. They have no reason to exist there once your dashboard is finalized.

nithys · ‎10-07-2024

My Dasboard runs the result of each row pannel even without the submit button is clicked....Trie giving the autoRun= false,searchwhenchanged=false.and submit button tag is added so search is only triggered when select dropdown & time is selected and they press submit button

nithys · ‎10-11-2024

waiting for reply

Add a submit button -fetch result only if submit is clicked

Classic dashboard

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

Index This | What are the 12 Days of Splunk-mas?